[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-105638":6},{"stargazers_count":4,"fetched_at":5},8,"2026-10-05T21:44:25.166Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":346,"aliases":347,"duplicate_of":9,"upstream":348,"downstream":349,"duplicates":350,"related":351,"reserved_at":9,"published_at":352,"modified_at":353,"state":354,"summary":355,"references_raw":362,"kevs":382,"epss":9,"epss_history":383,"metrics":384,"affected":392},"CVE-2026-105638","Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-307","Improper Restriction of Excessive Authentication Attempts","The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.","weakness","Draft","Base",[19,23,105,164,249,284,342],{"id":20,"name":21,"techniques":22},"CAPEC-16","Dictionary-based Password Attack",[],{"id":24,"name":25,"techniques":26},"CAPEC-49","Password Brute Forcing",[27],{"id":28,"name":29,"tactics":30,"countermeasures":34},"T1110.001","Password Guessing",[31],{"id":32,"name":33},"TA0031","Credential Access",[35,40,45,50,54,58,63,67,71,75,79,84,89,93,97,101],{"id":36,"name":37,"tactic":38},"D3-OPM","Operational Process Monitoring",{"name":39},"Detect",{"id":41,"name":42,"tactic":43},"D3-OTP","One-time Password",{"name":44},"Harden",{"id":46,"name":47,"tactic":48},"D3-CR","Credential Revocation",{"name":49},"Evict",{"id":51,"name":52,"tactic":53},"D3-CCSA","Credential Compromise Scope Analysis",{"name":39},{"id":55,"name":56,"tactic":57},"D3-PR","Password Rotation",{"name":44},{"id":59,"name":60,"tactic":61},"D3-RIC","Reissue Credential",{"name":62},"Restore",{"id":64,"name":65,"tactic":66},"D3-MFA","Multi-factor Authentication",{"name":44},{"id":68,"name":69,"tactic":70},"D3-PWA","Password Authentication",{"name":44},{"id":72,"name":73,"tactic":74},"D3-CRO","Credential Rotation",{"name":44},{"id":76,"name":77,"tactic":78},"D3-CDP","Change Default Password",{"name":44},{"id":80,"name":81,"tactic":82},"D3-CTS","Credential Transmission Scoping",{"name":83},"Isolate",{"id":85,"name":86,"tactic":87},"D3-DUC","Decoy User Credential",{"name":88},"Deceive",{"id":90,"name":91,"tactic":92},"D3-SPP","Strong Password Policy",{"name":44},{"id":94,"name":95,"tactic":96},"D3-AEM","Application Exception Monitoring",{"name":39},{"id":98,"name":99,"tactic":100},"D3-CH","Credential Hardening",{"name":44},{"id":102,"name":103,"tactic":104},"D3-ANCI","Authentication Cache Invalidation",{"name":49},{"id":106,"name":107,"techniques":108},"CAPEC-560","Use of Known Domain Credentials",[109],{"id":110,"name":111,"tactics":112,"countermeasures":128},"T1078","Valid Accounts",[113,116,119,122,125],{"id":114,"name":115},"TA0030","Defense Evasion",{"id":117,"name":118},"TA0005","Stealth",{"id":120,"name":121},"TA0110","Persistence",{"id":123,"name":124},"TA0111","Privilege Escalation",{"id":126,"name":127},"TA0108","Initial Access",[129,133,137,142,146,150,154,158,160],{"id":130,"name":131,"tactic":132},"D3-RUAA","Restore User Account Access",{"name":62},{"id":134,"name":135,"tactic":136},"D3-ULA","Unlock Account",{"name":62},{"id":138,"name":139,"tactic":140},"D3-AM","Access Modeling",{"name":141},"Model",{"id":143,"name":144,"tactic":145},"D3-AL","Account Locking",{"name":49},{"id":147,"name":148,"tactic":149},"D3-UAP","User Account Permissions",{"name":83},{"id":151,"name":152,"tactic":153},"D3-LAM","Local Account Monitoring",{"name":39},{"id":155,"name":156,"tactic":157},"D3-AA","Agent Authentication",{"name":44},{"id":76,"name":77,"tactic":159},{"name":44},{"id":161,"name":162,"tactic":163},"D3-DAM","Domain Account Monitoring",{"name":39},{"id":165,"name":166,"techniques":167},"CAPEC-565","Password Spraying",[168],{"id":169,"name":166,"tactics":170,"countermeasures":172},"T1110.003",[171],{"id":32,"name":33},[173,175,179,181,185,187,191,195,199,201,203,205,209,213,217,219,221,223,227,229,231,233,235,239,243,245,247],{"id":72,"name":73,"tactic":174},{"name":44},{"id":176,"name":177,"tactic":178},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":39},{"id":98,"name":99,"tactic":180},{"name":44},{"id":182,"name":183,"tactic":184},"D3-RTSD","Remote Terminal Session Detection",{"name":39},{"id":64,"name":65,"tactic":186},{"name":44},{"id":188,"name":189,"tactic":190},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":39},{"id":192,"name":193,"tactic":194},"D3-CSPP","Client-server Payload Profiling",{"name":39},{"id":196,"name":197,"tactic":198},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":39},{"id":85,"name":86,"tactic":200},{"name":88},{"id":80,"name":81,"tactic":202},{"name":83},{"id":51,"name":52,"tactic":204},{"name":39},{"id":206,"name":207,"tactic":208},"D3-NTSA","Network Traffic Signature Analysis",{"name":39},{"id":210,"name":211,"tactic":212},"D3-APCA","Application Protocol Command Analysis",{"name":39},{"id":214,"name":215,"tactic":216},"D3-NTF","Network Traffic Filtering",{"name":83},{"id":102,"name":103,"tactic":218},{"name":49},{"id":55,"name":56,"tactic":220},{"name":44},{"id":68,"name":69,"tactic":222},{"name":44},{"id":224,"name":225,"tactic":226},"D3-ANAA","Administrative Network Activity Analysis",{"name":39},{"id":76,"name":77,"tactic":228},{"name":44},{"id":90,"name":91,"tactic":230},{"name":44},{"id":41,"name":42,"tactic":232},{"name":44},{"id":46,"name":47,"tactic":234},{"name":49},{"id":236,"name":237,"tactic":238},"D3-CAA","Connection Attempt Analysis",{"name":39},{"id":240,"name":241,"tactic":242},"D3-NTCD","Network Traffic Community Deviation",{"name":39},{"id":94,"name":95,"tactic":244},{"name":39},{"id":36,"name":37,"tactic":246},{"name":39},{"id":59,"name":60,"tactic":248},{"name":62},{"id":250,"name":251,"techniques":252},"CAPEC-600","Credential Stuffing",[253],{"id":254,"name":251,"tactics":255,"countermeasures":257},"T1110.004",[256],{"id":32,"name":33},[258,260,262,264,266,268,270,272,274,276,278,280,282],{"id":176,"name":177,"tactic":259},{"name":39},{"id":188,"name":189,"tactic":261},{"name":39},{"id":192,"name":193,"tactic":263},{"name":39},{"id":196,"name":197,"tactic":265},{"name":39},{"id":206,"name":207,"tactic":267},{"name":39},{"id":214,"name":215,"tactic":269},{"name":83},{"id":210,"name":211,"tactic":271},{"name":39},{"id":240,"name":241,"tactic":273},{"name":39},{"id":182,"name":183,"tactic":275},{"name":39},{"id":94,"name":95,"tactic":277},{"name":39},{"id":36,"name":37,"tactic":279},{"name":39},{"id":236,"name":237,"tactic":281},{"name":39},{"id":224,"name":225,"tactic":283},{"name":39},{"id":285,"name":286,"techniques":287},"CAPEC-652","Use of Known Kerberos Credentials",[288],{"id":289,"name":290,"tactics":291,"countermeasures":293},"T1558","Steal or Forge Kerberos Tickets",[292],{"id":32,"name":33},[294,298,300,302,304,308,310,312,314,316,318,320,322,324,326,328,330,334,336,338,340],{"id":295,"name":296,"tactic":297},"D3-TBA","Token-based Authentication",{"name":44},{"id":214,"name":215,"tactic":299},{"name":83},{"id":240,"name":241,"tactic":301},{"name":39},{"id":210,"name":211,"tactic":303},{"name":39},{"id":305,"name":306,"tactic":307},"D3-RTA","RPC Traffic Analysis",{"name":39},{"id":80,"name":81,"tactic":309},{"name":83},{"id":196,"name":197,"tactic":311},{"name":39},{"id":59,"name":60,"tactic":313},{"name":62},{"id":51,"name":52,"tactic":315},{"name":39},{"id":64,"name":65,"tactic":317},{"name":44},{"id":102,"name":103,"tactic":319},{"name":49},{"id":176,"name":177,"tactic":321},{"name":39},{"id":46,"name":47,"tactic":323},{"name":49},{"id":192,"name":193,"tactic":325},{"name":39},{"id":85,"name":86,"tactic":327},{"name":88},{"id":72,"name":73,"tactic":329},{"name":44},{"id":331,"name":332,"tactic":333},"D3-TB","Token Binding",{"name":44},{"id":98,"name":99,"tactic":335},{"name":44},{"id":182,"name":183,"tactic":337},{"name":39},{"id":188,"name":189,"tactic":339},{"name":39},{"id":206,"name":207,"tactic":341},{"name":39},{"id":343,"name":344,"techniques":345},"CAPEC-653","Use of Known Operating System Credentials",[],[],[],[],[],[],[],"2026-10-05T18:09:35.649Z","2026-10-05T18:44:08.562Z","Deferred",{"cisa_kev":356,"cisa_ransomware":356,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":357,"severity_score":358,"severity_version":359,"severity_source":360,"severity_vector":361,"severity_status":354},false,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[363,369,374,378],{"url":364,"sources":365,"tags":367},"https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq",[360,366],"nvd",[368],"X Refsource CONFIRM",{"url":370,"sources":371,"tags":372},"https://github.com/makeplane/plane/pull/9130",[360,366],[373],"X Refsource MISC",{"url":375,"sources":376,"tags":377},"https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a",[360,366],[373],{"url":379,"sources":380,"tags":381},"https://github.com/makeplane/plane/releases/tag/v1.4.0",[360,366],[373],[],[],[385,390],{"source":360,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":386,"cvss_v4_0":9},{"baseScore":358,"baseSeverity":387,"vectorString":361,"impactScore":388,"exploitabilityScore":389},"CRITICAL",8.7,10,{"source":366,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":391,"cvss_v4_0":9},{"baseScore":358,"baseSeverity":387,"vectorString":361,"impactScore":388,"exploitabilityScore":389},[393],{"ecosystem":9,"name":394,"vendor":395,"product":394,"cpe_part":396,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":397},"plane","makeplane","a",[398],{"version":399,"is_range":400,"range_type":360,"version_start":9,"version_start_type":9,"version_end":401,"version_end_type":402,"fixed_in":9},"\u003C 1.4.0",true,"1.4.0","excluding"]